All Articles & Walkthroughs

Identifying the AWS Account ID from a Public S3 Bucket is a PwnedLabs beginner lab that focuses on discovering and attributing AWS cloud assets from public web footprinting. Initial reconnaissance of the IP address identifies an Apache web server referencing image assets stored in an Amazon S3 bucket named mega-big-tech. Querying the root bucket URL confirms unauthenticated s3:ListBucket and s3:GetObject permissions. Using the open-source tool s3-account-search alongside a controlled IAM role, condition-key policy evaluation was performed against the public bucket. Sequential digit-by-digit prefix probing isolated the target AWS Account ID as 107513503799, establishing the account boundary required for subsequent cloud security auditing.

DutyBound is a Medium difficulty HackTheBox machine that is part of Season 12.

Silo is a Windows machine that begins by enumerating an exposed Oracle TNS Listener on port 1521. SID brute-forcing identifies the active XE database instance, allowing odat passwordguesser to recover valid database credentials. Leveraging Oracle's UTL_FILE package with --sysdba privileges permits uploading a custom 64-bit ASPX Meterpreter payload directly into the IIS web root. Executing the web shell yields an initial reverse shell under the service context iis apppool\defaultapppool. Because IIS service accounts possess SeImpersonatePrivilege by default, executing Metasploit's getsystem forces spoolsv.exe to authenticate to a rogue pipe, enabling token capture and immediate elevation to NT AUTHORITY\SYSTEM to retrieve the root flag.

Breach in the Cloud is a PwnedLabs beginner lab that features an AWS incident response lab that begins with analysing compromised access keys belonging to temp-user. Inspecting the inline IAM policy test-temp-user reveals permission to execute sts:AssumeRole targeting AdminRole. Although assuming the role provides temporary elevated session credentials, global bucket enumeration is restricted by policy boundaries. Parsing CloudTrail log entries using jq isolates extensive automated IAM discovery and tracks an attacker session. Querying ListObjects and GetObject log entries identifies direct API targeting of the emergency-data-recovery S3 bucket. Re-evaluating CLI access against the specific bucket path bypasses global listing limits, permitting retrieval of emergency.txt and message.txt to confirm data exfiltration and complete the forensic investigation.

Remote is an easy-difficulty HackTheBox Windows machine that begins with enumerating an unauthenticated NFS share to exfiltrate web application backup files. Extracting the SQL Server Compact database file exposes a SHA1 hash for [email protected], which is cracked offline to recover the password. Authenticating to the Umbraco CMS portal allows exploiting an XSLT Remote Code Execution vulnerability (CVE-2019-25137) to execute a PowerShell download cradle and establish an initial reverse shell. Local enumeration reveals an installation of legacy TeamViewer 7, which stores encrypted credentials in the Windows Registry using a globally known AES key. Decrypting these registry keys yields the unattended password, enabling WinRM authentication as administrator to achieve full host compromise and capture the root flag.

BountyHunter is an easy-difficulty HackTheBox Linux machine that begins with web enumeration on an Apache web server running a bug reporting portal. Submitting bug reports transmits Base64-encoded XML payloads to a backend parser vulnerable to XML External Entity (XXE) injection. Leveraging the PHP stream wrapper exfiltrates the source code of db.php, recovering a cleartext password. Password reuse allows securing an SSH initial access shell as the development user. Sudo privileges permit development to execute a custom Python validation script as root. Static analysis reveals unsafe evaluation of ticket code input via eval(), which is exploited by injecting a Python system command payload into a custom ticket file to spawn an interactive root shell and capture the root flag.

Timelapse is an easy-difficulty HackTheBox machine centred on SSL/TLS certificate extraction, PowerShell history enumeration, and Active Directory LAPS misconfigurations on a Windows Domain Controller. Initial reconnaissance reveals unauthenticated guest access to the Shares SMB share, allowing exfiltration of a password-protected backup archive. Cracking the ZIP archive password and subsequent PFX container passphrase yields a client SSL certificate and private key, granting initial WinRM access. Inspecting the PowerShell PSReadLine history file exposes cleartext credentials for svc_deploy, enabling lateral movement. Because svc_deploy belongs to the LAPS_Readers domain group, querying the confidential Active Directory attribute ms-Mcs-AdmPwd via Get-ADComputer extracts the cleartext password for the local Administrator account, leading to full host compromise and root flag retrieval.

Support is a medium-difficulty HackTheBox machine that begins with unauthenticated SMB share enumeration against a Windows Server 2022 Domain Controller. Guest access to the support-tools share yields a custom .NET executable, which is decompiled to reverse a dual-XOR decryption routine and extract credentials for support\ldap. Querying Active Directory user attributes via ldapsearch reveals the cleartext password for the support user stored inside its info field, securing initial WinRM access. Because support belongs to Shared Support Accounts with GenericAll rights over the domain controller computer object, a fake computer account is created via SAMR to configure Resource-Based Constrained Delegation (RBCD). Finally, S4U Kerberos delegation extensions are executed to impersonate the Domain Administrator for CIFS/dc.support.htb, granting full administrative file access over SMB to retrieve the root flag.

Administrator is a medium-difficulty HackTheBox machine that begins with low-privileged credentials for Olivia on an Active Directory domain controller. Leveraging GenericAll permissions over michael, an RPC password reset is executed to gain host access, followed by abusing michael's ForceChangePassword rights to reset benjamin's password. Authenticating as benjamin via FTP allows exfiltrating an encrypted Password Safe database (Backup.psafe3), which is cracked offline to extract credentials for emily and establish initial WinRM access to capture the user flag. Emily's GenericWrite rights over ethan are then exploited via Targeted Kerberoasting to recover ethan's cleartext password. Finally, because ethan holds GetChanges and GetChangesAll replication privileges on the domain object, a DCSync attack is executed to dump the Domain Administrator NTLM hash and achieve full domain compromise.